The aforementioned gradient inversion attacks operate under the honest-but-curious setting where the server faithfully executes the federated learning protocol, but attempts to extract private information from the observed gradients. [1]}, [2]} and [3]} consider a stronger malicious server threat model that allows the server to transmit arbitrary model parameters \(\mathbf {w}\)  to the clients. Under this threat model, it is possible to carefully craft the model parameters so that the training sample can be recovered exactly from its gradient even when the batch size \(B\)  is large. While this setting is certainly realistic and relevant, our paper operates under the weaker honest-but-curious threat model.
